1

After I downloaded the Tails ISO I downloaded gpg4win. I did a quick virus scan of the gpg4win file and my Comodo antivirus said it was a "TrojWare.Win32.Kryptik.AGMN@284730160"! So I had to spend a long time figuring out if it was a false positive or not. At the gpg4win forum there were some vague mentioning about malware warnings and false positives all the way back in 2014, which means nothing has been done to fix this yet!

I eventually found a way to upload the gpg4win-2.2.5.exe to the Comodo cloud for analysis, which gave a report with a bunch of numbers and stuff and a statement about something "undetected", supposedly that no malware was detected, though it didn't explicitly say that.

No mentioning about gpg4win and trojan neither at the Comodo forum nor anywhere else. Very strange. Maybe I'm one of the very few who bothers to check files for malware after download.

Anyway, I decided to take the risk and install gpg4win and hope for the best. So after I had installed that I followed the instructions located here:

https://tails.boum.org/download/index.en.html#verify

..those that are shown after one clicks the link that says "Using other operating systems".

The link that says "Consult the Gpg4win documentation to import it" doesn't link to anything about importing a key specifically. It only talks about importing certificates.

The correct procedure here must be to simply right-click on the "tails-signing.key" and select "Import keys", which appears to work.

Next step is to verify the signature, but following the instructions don't seem to work properly. There is nothing that says "Decrypt and check" anywhere. The closest thing to choose is "Decrypt and verify" but this function will report the following:

tails-i386-1.4.1.iso.sig: Not enough information to check signature validity.

Signed on 2015-06-29 11:07 with unknown certificate 0xA5091F72C746BA6B163D1C183C83DCB52F699C56. The validity of the signature cannot be verified.

Either it means the signature is wrong or the verification doesn't work or the instructions how to do it is wrong.

My impression of this is that this is only for Tor experts and it's software makers to mess with, because it's way too complicated for normal people, which means people don't stand a chance against NSA. Humanity is damned! >:-|

Improve this question
3
  • thanks for your long comment. But I fail to see what your question is. Could you edit your question to make it clear what you're asking? The site Virustotal knows of some anti-virusscanners which think gpg4win contains a virus.
    – Jens Kubieziel
    Commented Aug 1, 2015 at 23:24
  • OK, the short version.... Following the instructions to the letter gives bad results when checking the signatures! I tried a couple of other programs instead to check the signatures; "fciv.exe" from Microsoft and "sha1sum.exe" from the ftp where the "Gpg4win" software is located. So when I checked the signatures of the Tail ISO file I got a different signature than the one that is displayed on the download page for Tail. So it looks like the ISO file has been compromised! Woe to those who have installed Tail 1.4.1! I'm done with this! >:-p
    – SignatureMess
    Commented Aug 2, 2015 at 1:23
  • The "Not enough information to check signature validity." message is expected. Did you read all of the instructions on the page? Underneath the green download buttons, it says... "If you see the following warning: ... the ISO image is still correct, and valid according to the Tails signing key that you downloaded."
    – Richard Horrocks
    Commented Aug 2, 2015 at 9:10

1 Answer 1

Reset to default
0

I will focus this answer on verifying Tails using gpg4win because my understanding is that that is where you are having the most trouble.

There is the possibility here that you were the victim of a man is the middle attack or that the tails iso or gpg4win installer was corrupted during the download, but you may just not have verified the iso properly. You should first ensure that the gpg4win installer you downloaded is intact and as the gpg4win developers intended it to be.

You can do this by verifying the sha1 cryptographic checksum or if you have a working copy of gpg on a different operating system (linux most always comes with this already installed) or an older and already verified version of gpg4win you can do this with the gpg signature from their website and the key they give you which can be downloaded from most of the usual keyservers.

Once you are happy with your gpg4win installer you can try to veryfy the tails iso again. Finding instructions for someone who is not familiar with gpg may itself be a little challenging so here are some simple, copy and paste instructions.

Some editing is still required but I will point out out where it is.

Open a Command Prompt window (cmd)

1st recieve the key from a keyserver:

"C:\Program Files (x86)\Gnu\GnuPg\gpg2" --keyserver pgp.mit.edu --recv-keys 58ACD84F

IMPORTANT EDIT: The above command will request a key from pgp.mit.edu however it will most likely send the request for the key over the normal internet and not through a tor circuit. This means the key request will not be anonymous! If you are in a country where tor is illegal or where others knowing that you use tor would put you in danger, DO NOT use this command. Find another way to import the key through tor. It should be possible to download the key and import it, follow these instructions from the link on the tails website http://www.gpg4win.org/doc/en/gpg4win-compendium_15.html

If you are using a 64bit OS these instructions should work as long as you installed gpg4win with the default values. if you are using a 32bit OS then remove the (x86) i.e. "C:\Program Files\Gnu................the rest is the same.

2nd Check the fingerprint with:

"C:\Program Files (x86)\Gnu\GnuPg\gpg2" --fingerprint 58ACD84F

Again the same change needed for 32 bit OS. The result of this command should be a fingerprint the main fingerprint should be:

A490 D0F4 D311 A415 3E2B B7CA DBB8 02B2 58AC D84F

3rd now you have the correct key imported, it is time to verify the iso. Make sure you have both the iso and the signature file downloaded to the same place. For these instructions I will assume you saved both files to your desktop, and that your name is Alice.

If your pc username is not Alice, replace the two uses of Alice in the following command to whatever your actual username is. If you don't save the files to your desktop the full path to the directory you did save the files to must be given instead of the full path to the desktop. Also the usual change needs to be made if you are using a 32bit OS.

"C:\Program Files (x86)\Gnu\GnuPg\gpg2" --verify C:\Users\Alice\Desktop\tails-i386-1.4.1.iso.sig C:\Users\Alice\Desktop\tails-i386-1.4.1.iso

This last one takes a minute to run. You should see Good signature. If you do, you are done and can burn the iso onto your chosen media.

I tested these instructions with my very well verified version of gpg4win 2.2.4 but they should work with the new version too.

Improve this answer
5
  • Verified keys. Got this (translated from Swedish): gpg: assuming signed data in 'file path\tails-i386-1.4.1.iso' gpg: Signatur made timestamp-bla-bla with RSA key-id2F699C56 gpg: Correct signature from "Tails developers (offline long-term identity key) <[email protected]>" [unknown] gpg: WARNING: This key is not certified with a reliable signature! gpg: There is nothing that indicates that the signature belongs to the owner. Primary key fingerprint: A490 D0F4 D311 A415 3E2B B7CA DBB8 02B2 58AC D84F Secondary key fingerprint: A509 1F72 C746 BA6B 163D 1C18 3C83 DCB5 2F69 9C56
    – SignatureMess
    Commented Aug 2, 2015 at 12:18
  • I tried downloading the Tails iso and signatures from two locations and both times I got the wrong signatures. Now what?
    – SignatureMess
    Commented Aug 2, 2015 at 12:35
  • The result you got from your verification shows that you downloaded the correct keys. The primary key fingerprint is the one that I suggested you download in my answer and the secondary key is a valid tails sub key. The 'short key-id' is the last 8 characters of the fingerprint. The verification output shows that the tails key you downloaded was the key used to create the signature and the "correct signature" is the translation for "good signature", showing that your verification was successful and the iso is good. The warning can be ignored, It's only saying you haven't signed the tails key.
    – Joey
    Commented Aug 3, 2015 at 0:00
  • @SignatureMess After reviewing my answer the impotant edit may not have been so important, tor is not officially illegal anywhere as discussed here tor.stackexchange.com/questions/6744/… but some people may still want to receive the key anonymously anyway. My first comment explains the verification output. If this answers your question then "How to verify tails using gpg4win" may be a better question and the gpg4win complaints may be better left for the gpg4win forum you mentioned if that were the case Jens Kubieziel might not have closed your question.
    – Joey
    Commented Aug 3, 2015 at 15:08
  • Damn, I thought THIS was the correct key: "SHA256 checksum c7bf55250ca7a7ad897fd219af6ef3d4768be54fb3e2537abb3da8f7f4ed8913" ..that is displayed on the Tails download page. :-p ..and I understand now what the warning message means; the same as in this post: tor.stackexchange.com/questions/7364/tor-browser-key-problem I see now that the keys are correct. :-)
    – SignatureMess
    Commented Aug 3, 2015 at 18:04

Not the answer you're looking for? Browse other questions tagged .